Is there any risk when enabling CMD.exe in Applocker?

Question

Is there any risk when enabling CMD.exe in Applocker?

Nelson Mauricio Zamudio Arias 21

Hello everyone.
We have a Mysql application called MYSQLDUMP that works to export information from MYsql databases, this program needs to use cmd.exe, but the applocker blocks it.
Is there any risk if we enable said CMD.exe?
Thanks for the help.

Answer accepted by question author

1 additional answer

Your answer

Answer 1

Hi,
CMD can be used safely for users.
Users can only run commands with their permission.
If user run some command to change or write date on the clients without rights, they will encounter access denied error or there will be an elevation prompt for standard users.
Make sure the UAC was enabled and you can set policy: User Account Control: Behavior of the elevation prompt for standard users to the following settings:

You can restrict the permissions for users on the clients or resource.

Best Regards,

Answer 2

Vadims Podāns 9,246 MVP

No, there are no risks with CMD, it is Windows component and safe to run.

Nelson Mauricio Zamudio Arias 21 Reputation points

2021-04-08T17:33:26+00:00

Hi, Crypt32.
Thanks for answering, is there no security risk in enabling CMD on a server where it is used by multiple people?
We must enable this application, but we have doubts if by enabling it, a user can perform an improper action in our operating system, taking into account that they are non-administrator users.
Thanks for your help
Vadims Podāns 9,246 Reputation points MVP

2021-04-08T19:24:38.147+00:00

Using CMD, they cannot elevate themselves to privileged account or do something that is not allowed by their permissions or rights. There are plenty ways to run commands/apps without CMD, so disabling CMD you benefit nothing. There are more powerful tools out of the box, for example, PowerShell which is magnitudes more powerful and allow to perform complex things easier. Applocker should enforce protection on folders where users can write data to minimize (not avoid, but minimize) chances that people will run unauthorized software.

Share via

Is there any risk when enabling CMD.exe in Applocker?

1 additional answer

Your answer